[lucasbraum]

Closes UPT-105. Refs UPT-102 (not closed: see the enki rerun below).

What and why

On enki (UpgradeBench, #169), the vitest junit reporter writes test-report.xml, which the repository does not gitignore. The baseline-tests guard treated any untracked file as a change, so fix stopped with "baseline tests modified the working tree" before doing anything.

Now:

• Untracked files are snapshotted before the baseline tests (untrackedFiles). After the run, a change to a tracked file still refuses, as before. New untracked files are test artifacts (testArtifacts in verify.ts).
• Artifacts go in the private clone's .git/info/exclude, anchored at the repo top (with the project's subdirectory prefix, and pattern characters escaped). No status, diff, git add or ls-files --exclude-standard sees them. That keeps them out of commits, the agent's diff (including tests the agent runs itself), the follow-up and style steps, and the verificationPending check, from one place.
• They are removed right away, and again before each later test run: clearing() wraps services.tests once, after baseline, so settle, the rules' transactions, the agent gate and the feedback rounds all go through it.
• The report records them (testArtifacts). uptide verify runs in a fresh clone, so it re-applies the exclude and clearing from the stored run; otherwise its final test run would leave the file and fail.
• The same applies to the Stripe pin path (pin.ts).

fix and verify always run in a private clone (isolatedFix/isolatedVerify), so writing info/exclude never touches the user's checkout. The comment there names the ceiling if either ever runs in place.

Tests

• fix.test.ts: the fixture's test script writes an untracked test-report.xml and fails if the previous run's file is still there. Baseline and final verification pass, testArtifacts is ['test-report.xml'], the file is in no commit and not in changedFiles, nothing is pending. uptide verify from a fresh clone (no exclude entry, no file on disk) also passes.
• fix.test.ts: a baseline test run that writes an untracked report and changes a tracked file still refuses.
• verify.test.ts: a project in a subdirectory, with names containing [ ] # ! space, is hidden and nothing else is.
• Reverting the run change brings back the original refusal. Reverting only the reverify change fails the verify assertion.
• pnpm lint, pnpm typecheck, pnpm test: green locally (core 2268 passed).

enki rerun (#169 harness, Uptide arm only, claude-sonnet-5-5, $1 cap)

Run 7f90b41c, from this branch's build (8d1d8bb).

Baseline tests	passed the guard (this fix)
Stopped at	lockfile install of react 19.2.0 + @entur/react-component-toggle 1.0.0: npm install --package-lock-only → ERESOLVE, exit 2
Clean-install check (#220)	not reached: no draft
Checks	none on a draft: head is the parent commit
Cost	$0.00 (no agent call)
Wall time	54 s
Fork CI	none: no commits, so no fork pull request

The cause, reproduced outside Uptide: starting from the parent's package-lock.json, npm install --package-lock-only fails with the same ERESOLVE even with the human upgrade's exact package.json (ed37dd2). Without the old lockfile, the same manifest resolves (exit 0). So Uptide's companion set matches the human's. What blocks is npm's resolution starting from the old lockfile, not the plan. Two defects show up here: the install step has no fallback for this, and fix --json printed nothing on this exit 2. The run ended as a raw npm error instead of a "blocked by" result.

UPT-102's done-criterion (a draft that installs, or a clear "blocked by") is not met yet, so this PR does not close it.

🤖 Generated with Claude Code